Webhook event

The signed body delivered to your webhook. The signature is in the `X-DarkRadar-Signature` header.

Fields

idstring
Delivery id (`evt_…`); same as the `X-DarkRadar-Delivery` header. Do not process an id twice.

typestring
Event type: `leak.created`, `leak.shared` (shared by hand from the dashboard), `scan.finished`, `scan.failed`, `hunter.finding.created`, `webhook.test`.

createdAtstring
When the event was created for delivery (ISO 8601).

Content that depends on the event. Leak events carry event fields, scan events carry scan fields.

data.eventIdstring
Leak event id — get details with `GET /v1/leak-events/{eventId}`. (leak events)

data.leakTypestring
What the leak matched: `domain`, `email`, `username`, `ip`, `hwid`, `application`. (leak events)

data.typestring
Whose leak: `employee`, `customer` (360), `third_party`. (leak events)

data.severitystring
Severity: `critical`, `high`, `medium`, `low`, `unknown`. (leak events)

data.statusstring
For leak events the event status (`open` …); for scan events `completed` or `failed`.

data.eventDatestring
When the leak happened (infection date). (leak events)

data.stealerFamilystring
Stealer family. (leak events)

data.groupIdstring
Related protection resource group.

data.scanIdstring
Scan id — `GET /v1/scans/{scanId}`. (scan events)

data.completedAtstring
When the scan ended. (scan events)

data.statsobject
Scan result counts; zero for a failed scan. (scan events)

data.stats.totalMatchesnumber
Total matches.

data.stats.newMatchesnumber
Matches found for the first time in this scan.

data.stats.severitiesobject
Match counts by severity.

data.stats.severities.criticalnumber
Critical.

data.stats.severities.highnumber
High.

data.stats.severities.mediumnumber
Medium.

data.stats.severities.lownumber
Low.

data.stats.severities.infonumber
Info.

data.stats.severities.unknownnumber
Unknown.

data.messagestring
Explanation. (`webhook.test` only)

data.targetIdstring
The watched target with new findings — `GET /v1/hunter/findings?targetId=…`. (`hunter.finding.created`)

data.targetKindstring
Target type (e.g. `domain`, `email`). (`hunter.finding.created`)

data.newFindingsnumber
Number of findings added in this scan; `data.severity` is the highest severity. (`hunter.finding.created`)

JSON schema

{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://darkradar.com/docs/schemas/webhook-event.schema.json",
  "title": "Webhook event",
  "description": "The signed body delivered to your webhook. The signature is in the `X-DarkRadar-Signature` header.",
  "type": "object",
  "properties": {
    "id": {
      "type": "string",
      "description": "Delivery id (`evt_…`); same as the `X-DarkRadar-Delivery` header. Do not process an id twice."
    },
    "type": {
      "type": "string",
      "description": "Event type: `leak.created`, `leak.shared` (shared by hand from the dashboard), `scan.finished`, `scan.failed`, `hunter.finding.created`, `webhook.test`."
    },
    "createdAt": {
      "type": "string",
      "description": "When the event was created for delivery (ISO 8601)."
    },
    "data": {
      "type": "object",
      "description": "Content that depends on the event. Leak events carry event fields, scan events carry scan fields.",
      "properties": {
        "eventId": {
          "type": "string",
          "description": "Leak event id — get details with `GET /v1/leak-events/{eventId}`. (leak events)"
        },
        "leakType": {
          "type": "string",
          "description": "What the leak matched: `domain`, `email`, `username`, `ip`, `hwid`, `application`. (leak events)"
        },
        "type": {
          "type": "string",
          "description": "Whose leak: `employee`, `customer` (360), `third_party`. (leak events)"
        },
        "severity": {
          "type": "string",
          "description": "Severity: `critical`, `high`, `medium`, `low`, `unknown`. (leak events)"
        },
        "status": {
          "type": "string",
          "description": "For leak events the event status (`open` …); for scan events `completed` or `failed`."
        },
        "eventDate": {
          "type": "string",
          "description": "When the leak happened (infection date). (leak events)"
        },
        "stealerFamily": {
          "type": "string",
          "description": "Stealer family. (leak events)"
        },
        "groupId": {
          "type": "string",
          "description": "Related protection resource group."
        },
        "scanId": {
          "type": "string",
          "description": "Scan id — `GET /v1/scans/{scanId}`. (scan events)"
        },
        "completedAt": {
          "type": "string",
          "description": "When the scan ended. (scan events)"
        },
        "stats": {
          "type": "object",
          "description": "Scan result counts; zero for a failed scan. (scan events)",
          "properties": {
            "totalMatches": {
              "type": "number",
              "description": "Total matches."
            },
            "newMatches": {
              "type": "number",
              "description": "Matches found for the first time in this scan."
            },
            "severities": {
              "type": "object",
              "description": "Match counts by severity.",
              "properties": {
                "critical": {
                  "type": "number",
                  "description": "Critical."
                },
                "high": {
                  "type": "number",
                  "description": "High."
                },
                "medium": {
                  "type": "number",
                  "description": "Medium."
                },
                "low": {
                  "type": "number",
                  "description": "Low."
                },
                "info": {
                  "type": "number",
                  "description": "Info."
                },
                "unknown": {
                  "type": "number",
                  "description": "Unknown."
                }
              }
            }
          }
        },
        "message": {
          "type": "string",
          "description": "Explanation. (`webhook.test` only)"
        },
        "targetId": {
          "type": "string",
          "description": "The watched target with new findings — `GET /v1/hunter/findings?targetId=…`. (`hunter.finding.created`)"
        },
        "targetKind": {
          "type": "string",
          "description": "Target type (e.g. `domain`, `email`). (`hunter.finding.created`)"
        },
        "newFindings": {
          "type": "number",
          "description": "Number of findings added in this scan; `data.severity` is the highest severity. (`hunter.finding.created`)"
        }
      }
    }
  }
}